Clinical safety and assurance
What does a clinical safety officer do?
A clinical safety officer (CSO) is the person responsible for making sure a health IT system is safe through clinical risk management. Under DCB0129 and DCB0160 they must be a suitably qualified, experienced and currently registered clinician who knows risk management, and they approve the clinical risk management plan, every version of the hazard log and every clinical safety case report.
What the standards require of the person
Both specifications set the same four requirements (section 2.3):
- A suitably qualified and experienced clinician.
- Holding a current registration with an appropriate professional body for their training and experience.
- Knowledgeable in risk management and its application to clinical domains.
- Making sure the processes defined by the clinical risk management process are followed.
DCB0129's glossary notes the role was previously called the "Responsible Person". Top management must nominate the CSO, and also define in the risk management plan who can authorise the system and its safety documents.
What the clinical safety officer signs
- The clinical risk management plan, including the risk acceptability criteria.
- Each version of the hazard log; an issued hazard log goes with every safety case report.
- Each clinical safety case report. A manufacturer produces one at each lifecycle phase in its plan; a deploying organisation produces one for deployment, use, maintenance and decommissioning.
A manufacturer and a hospital each need their own CSO. The supplier's CSO signs off the product's DCB0129 work; the hospital's CSO signs off the DCB0160 work for how the product is used locally.
Where the CSO appears elsewhere
In a DTAC assessment, section C1 (clinical safety) lists the clinical safety officer or engineer as the subject matter expert, with a chief clinical or nursing information officer, executive nurse or clinician as the accountable officer. The earlier DTAC form required the named CSO to have done NHS England's training; NHS England says that requirement no longer stands. NHS England Digital still runs digital clinical safety training for NHS organisations and manufacturers. Its guidance on AI ambient scribing puts "assign a clinical safety officer and identify key risks" as the first step.
What it does not mean
- The CSO isn't a job title anyone can hold. The standards require a registered clinician with risk management knowledge.
- Signing isn't the whole job. The CSO makes sure the clinical risk management process is actually followed, not only that the documents exist.
- A supplier's CSO doesn't stand in for yours. DCB0160 needs a CSO in the deploying organisation.
Where Thalix fits
Thalix is built so that this process has somewhere to live. New agents, workflows, boards and tools ship as versioned apps with a risk tier worked out from their contents (0 views, 1 operational, 2 clinical information, 3 clinical decisions), with the reason shown. Nobody approves their own app; tier 2 also needs the clinical-safety role, which is the clinical safety officer's recorded and audited sign-off. Tier-3 apps exist only as Ed25519-signed, locked packages from a trusted publisher, and a failed upgrade puts the previous version back.
On the home page we say a pilot runs with your clinical safety officer involved from day one, and that your clinical safety team reviews each change before it goes live. In Thalix that review is a role in the system, not an email.
Thalix is at pilot stage. Demos run on synthetic data, and a hospital deployment needs its own clinical safety case, information governance approval and security review. We don't claim any certification or assessment result the product doesn't have.
Questions people ask
Does a clinical safety officer have to be a clinician?
Yes. DCB0129 and DCB0160 both say a clinical safety officer must be a suitably qualified and experienced clinician with a current registration with an appropriate professional body.
Is NHS England CSO training mandatory for DTAC?
Not any more. NHS England says the previous DTAC form required the named clinical safety officer to do NHS England's training, and that this requirement no longer stands.
What documents does a clinical safety officer approve?
The clinical risk management plan, each version of the hazard log, and each clinical safety case report.
Sources
Each source below is an official page, read and checked in October 2026. Where a page and this guide differ, the official page wins.
- DCB0129 specification v4.2 (Amd 24/2018, PDF) NHS England Digital · checked October 2026
- DCB0160 specification v3.2 (Amd 25/2018, PDF) NHS England Digital · checked October 2026
- Conduct a DTAC assessment NHS England Digital · checked October 2026
- Digital clinical safety NHS England Digital · checked October 2026
- Guidance on the use of AI-enabled ambient scribing products in health and care settings NHS England · checked October 2026
General information only, written for hospital digital, IT, operations and clinical safety teams. It isn't legal, regulatory, information governance or clinical safety advice, and it doesn't replace your own organisation's processes or the official guidance linked above.